JWT Decoder
Paste a JSON Web Token to see its header and payload as readable text, with issue and expiry times shown in your time zone.
Este contenido está en inglés.
Ejemplos resueltos
Reading a sample token
eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkFzaGEiLCJpYXQiOjE3MDAwMDAwMDB9.fakesig
Header: {"alg": "HS256", "typ": "JWT"} Payload: {"sub": "1234567890", "name": "Asha", "iat": 1700000000} Signature: not verified
The header and payload are only encoded, so anyone holding the token can read them, but the signature is not checked by this tool.
Spotting an expired token
A token whose payload contains "exp": 1700000000
Payload: {"sub": "42", "exp": 1700000000} Expiry: 14 November 2023 22:13 UTC, which has passed
A token whose expiry time has passed has run out and will usually be refused by the service that issued it.
Sobre JWT Decoder
A JSON Web Token is a compact string of text that many websites and apps use to show who a user is after they sign in. It has three parts separated by full stops: a header that names the method used to sign it, a payload that holds details such as the user, the issuer and the times the token is valid, and a signature. The header and payload are encoded so they can be placed in a request or a link, which also means anyone who has the token can read them. This decoder lays out both parts as readable text so you can see what a token contains.
The times inside a token are stored as numbers of seconds, which are hard to read. This tool converts the issue, not-before and expiry times into dates and times in your own time zone, and also shows them in UTC. It states how long ago or how long from now each time falls, so you can tell at a glance whether a token has expired. The signature is not checked by this tool, because checking it needs the secret key held by the system that issued the token.
Cómo usar JWT Decoder
- Paste the whole token into the box, including all three parts.
- Read the summary for the algorithm, token type, issuer and subject.
- Check the times to see when the token was issued and when it expires.
- Read the header and payload, and note the signature status, which always says NOT verified.
Usos habituales
- Finding out why a login token was refused because it had expired
- Checking which user and issuer a token was created for during debugging
- Confirming the expiry time that a service sets on its tokens
- Reading the claims in a token before writing code that handles it
Preguntas frecuentes
Does this tool confirm that a token is genuine?
No. This tool reads the header and payload and shows the times, but it does not check the signature. Confirming that a token is genuine needs the secret key or public key held by the system that issued it. Only that system, or a checking routine written into your own code, can perform the check. The result always states that the signature is not verified.
Should I paste a live token into this tool?
Treat any live token as a password. Anyone who holds a token can use it until it expires, so do not paste live tokens into tools you do not trust. For debugging, use tokens from test accounts where possible, or revoke and replace a token after you have shared it.
Why are the times shown in two time zones?
Tokens store their times in UTC, which is the same everywhere. Your local time is shown first because it is easier to understand, and UTC is shown beneath it so you can compare the token with logs or records kept on servers. The two lines always describe the same moment.
What does it mean when a token has no expiry time?
A token without an exp claim does not state when it stops being valid. Some systems accept such tokens indefinitely, which is a risk if they are stolen. The payload is still shown in full, so you can see whether any other limits, such as an audience or an issuer, have been set.
What does the alg value in the header mean?
The alg value names the method used to sign the token, such as HS256 or RS256. A value of none means the token was not signed at all, so anyone could have written it. The tool flags tokens with no signature so that you can spot them quickly.